diff --git a/conductor/tracks/test_sandbox_hardening_20260619/plan.md b/conductor/tracks/test_sandbox_hardening_20260619/plan.md
index ed0f94e1..53bbe34a 100644
--- a/conductor/tracks/test_sandbox_hardening_20260619/plan.md
+++ b/conductor/tracks/test_sandbox_hardening_20260619/plan.md
@@ -535,7 +535,7 @@
 
 **Focus:** Write `scripts/run_tests_sandboxed.ps1` (Windows-only, opt-in) that wraps pytest in a Windows restricted token + Job Object.
 
-- [ ] **Task 6.1:** Write `scripts/run_tests_sandboxed.ps1`.
+- [x] **Task 6.1:** Write `scripts/run_tests_sandboxed.ps1`. [dc5afc2]
   - **WHERE:** Create `scripts/run_tests_sandboxed.ps1`.
   - **WHAT:** Mirror `scripts/tier2/run_tier2_sandboxed.ps1` structure (100 lines). Replace OpenCode launch with pytest launch.
   - **HOW:** Tier 3 worker MUST read `scripts/tier2/run_tier2_sandboxed.ps1` end-to-end first (per writing-plans skill "Read Reference Implementation COMPLETELY"), then copy its Add-Type / Job Object / token-acquisition blocks verbatim. Only the LAST step (the actual process launch) differs. Full template:
@@ -605,7 +605,7 @@
   - **COMMIT:** `feat(scripts): add scripts/run_tests_sandboxed.ps1 (Phase 6, FR5 opt-in)`
   - **GIT NOTE:** "Phase 6 task 6.1: PowerShell wrapper for Windows restricted-token + Job Object pytest sandbox. Mirrors run_tier2_sandboxed.ps1 structure (Add-Type + token + Job Object blocks copied verbatim). Only the invocation differs (pytest instead of OpenCode). -WhatIf mode for dry-run. OPT-IN."
 
-- [ ] **Task 6.2:** Write a smoke test for `-WhatIf` mode.
+- [x] **Task 6.2:** Write a smoke test for `-WhatIf` mode. [dc5afc2]
   - **WHERE:** Add to `tests/test_test_sandbox.py` (as test 14).
   - **WHAT:** Verify `pwsh -File scripts/run_tests_sandboxed.ps1 -WhatIf` exits 0.
   - **HOW:**